Overview

overview

10

Static

static

3

6caba6315b...97.exe

windows7-x64

10

6caba6315b...97.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

8

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6caba6315b19d80df744b6778f2948a1fa213c18f88083682453daa807450e97.exe

  • Size

    562KB

  • Sample

    250208-d8m6ksvkap

  • MD5

    244bb269abd24ced77ddf83aff97f3d4

  • SHA1

    5cb60ac5a72ee67544733b19737db7b053ebccd6

  • SHA256

    6caba6315b19d80df744b6778f2948a1fa213c18f88083682453daa807450e97

  • SHA512

    ee01c3bbb22a4c1e5955da07f95bd16457b99e295d1e144898afa95f85b24de9f9ec6326abcc3879c898c35108c773e2ee5fa1893122050ea21c86acfc50ef80

  • SSDEEP

    12288:kk2tY1fkPNAFF46piAjeBG+Am3R3W6TRVZdMN:y6k1AgwiA6HRR1ZdM

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      6caba6315b19d80df744b6778f2948a1fa213c18f88083682453daa807450e97.exe

    • Size

      562KB

    • MD5

      244bb269abd24ced77ddf83aff97f3d4

    • SHA1

      5cb60ac5a72ee67544733b19737db7b053ebccd6

    • SHA256

      6caba6315b19d80df744b6778f2948a1fa213c18f88083682453daa807450e97

    • SHA512

      ee01c3bbb22a4c1e5955da07f95bd16457b99e295d1e144898afa95f85b24de9f9ec6326abcc3879c898c35108c773e2ee5fa1893122050ea21c86acfc50ef80

    • SSDEEP

      12288:kk2tY1fkPNAFF46piAjeBG+Am3R3W6TRVZdMN:y6k1AgwiA6HRR1ZdM

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      f1e9eed02db3a822a7ddef0c724e5f1f

    • SHA1

      65864992f5b6c79c5efbefb5b1354648a8a86709

    • SHA256

      6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

    • SHA512

      c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

    • SSDEEP

      48:S46+/fTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mjsofjLl:zRuPbOBtWZBV8jAWiAJCdv2Cmj/L

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      17ed1c86bd67e78ade4712be48a7d2bd

    • SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    • SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    • SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

    • SSDEEP

      192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks